3 ms·

Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or

Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going through such a flow with Deliveroo and if I did I would have disabled the "marketing" category for sure. 0: https://www.i-scoop.eu/gdpr/explicit-consent/ https://www.i-scoop.eu/gdpr/explicit-consent/

deleted 8y ago
[deleted]
detaro 8y ago
As the article you link notes: > As we wrote before consent is one of the six conditions for the lawfulness of processing personal data as stipulated in Article 6 of the GDPR text. > Again, there are other conditions for the lawfulness of processing personal data. If you're referring to the bit about "special categories of data" per Article 9, location is not such a category. That said, location data is sensitive, so there certainly are questions that can be asked about how and why they use this data. You can ask them for details.
scrollaway 8y ago
Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. What they might not have gotten, or at least not clearly, is your consent to send that data to a third party, explicitly and exclusively for marketing purposes. I don't know how this would play out. Realistically, GDPR and its enforcers err on the side of caution (you need good justification to gather the data and share it, including consent and a reason to gather it in the first place). So if you care about this and wish to see it corrected, as I said an email to their dpo@ will likely go a long way. In case it doesn't, your national enforcement agency may be interested. Extremely-accurate location data is pretty creepy, especially if they get it very often and doubly so if they store it for a long time. The #1 thing I would look at here is what they actually need it for. They may need it for security reasons (eg. anti-fraud measures) and happen to be storing it in Braze which is probably okay if Braze respects GDPR and Deliveroo signed a DPA with them (you'd be surprised the amount of companies storing security data in GA). But you wouldn't have a very hard time making a case that they're using this for marketing purposes and are gathering an unreasonable amount of accuracy. So now the question is, do you care about this enough to follow up on it? :)
- K0nserv 8y ago
  > To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage. In any case, like you say it's extremely creepy and the level of accuracy is worrying. 0: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/
  - scrollaway 8y ago
    I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it. I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts. The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it). But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)

deleted 8y ago

[deleted]

detaro 8y ago

As the article you link notes: > As we wrote before consent is one of the six conditions for the lawfulness of processing personal data as stipulated in Article 6 of the GDPR text. > Again, there are other conditions for the lawfulness of processing personal data. If you're referring to the bit about "special categories of data" per Article 9, location is not such a category. That said, location data is sensitive, so there certainly are questions that can be asked about how and why they use this data. You can ask them for details.

scrollaway 8y ago

Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. What they might not have gotten, or at least not clearly, is your consent to send that data to a third party, explicitly and exclusively for marketing purposes. I don't know how this would play out. Realistically, GDPR and its enforcers err on the side of caution (you need good justification to gather the data and share it, including consent and a reason to gather it in the first place). So if you care about this and wish to see it corrected, as I said an email to their dpo@ will likely go a long way. In case it doesn't, your national enforcement agency may be interested. Extremely-accurate location data is pretty creepy, especially if they get it very often and doubly so if they store it for a long time. The #1 thing I would look at here is what they actually need it for. They may need it for security reasons (eg. anti-fraud measures) and happen to be storing it in Braze which is probably okay if Braze respects GDPR and Deliveroo signed a DPA with them (you'd be surprised the amount of companies storing security data in GA). But you wouldn't have a very hard time making a case that they're using this for marketing purposes and are gathering an unreasonable amount of accuracy. So now the question is, do you care about this enough to follow up on it? :)

K0nserv 8y ago
> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage. In any case, like you say it's extremely creepy and the level of accuracy is worrying. 0: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/
- scrollaway 8y ago
  I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it. I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts. The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it). But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)